<!doctype html>



  


<html class="theme-next muse use-motion" lang="zh-Hans">
<head>
  <meta charset="UTF-8"/>
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/>









<meta http-equiv="Cache-Control" content="no-transform" />
<meta http-equiv="Cache-Control" content="no-siteapp" />















  
  
  <link href="/lib/fancybox/source/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css" />




  
  
  
  

  
    
    
  

  

  

  

  

  
    
    
    <link href="//fonts.googleapis.com/css?family=Lato:300,300italic,400,400italic,700,700italic&subset=latin,latin-ext" rel="stylesheet" type="text/css">
  






<link href="/lib/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css" />

<link href="/css/main.css?v=5.1.1" rel="stylesheet" type="text/css" />


  <meta name="keywords" content="Linux命令," />








  <link rel="shortcut icon" type="image/x-icon" href="/favicon.ico?v=5.1.1" />






<meta name="description" content="&amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#160;ss是Socket Statistics的缩写。顾名思义，ss命令可以用来获取socket统计信息，它可以显示和netstat类似的内容。但ss的优势在于它能够显示更多更详细的有关TCP和连接状态的信息，而且比netstat更快速更高效。 &amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#">
<meta name="keywords" content="Linux命令">
<meta property="og:type" content="article">
<meta property="og:title" content="Linux 命令- ss">
<meta property="og:url" content="https://hcldirgit.github.io/2017/09/03/2. Linux 命令/59. Linux 命令- ss/index.html">
<meta property="og:site_name" content="失落的乐章">
<meta property="og:description" content="&amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#160;ss是Socket Statistics的缩写。顾名思义，ss命令可以用来获取socket统计信息，它可以显示和netstat类似的内容。但ss的优势在于它能够显示更多更详细的有关TCP和连接状态的信息，而且比netstat更快速更高效。 &amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#">
<meta property="og:locale" content="zh-Hans">
<meta property="og:updated_time" content="2017-09-01T08:37:19.617Z">
<meta name="twitter:card" content="summary">
<meta name="twitter:title" content="Linux 命令- ss">
<meta name="twitter:description" content="&amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#160;ss是Socket Statistics的缩写。顾名思义，ss命令可以用来获取socket统计信息，它可以显示和netstat类似的内容。但ss的优势在于它能够显示更多更详细的有关TCP和连接状态的信息，而且比netstat更快速更高效。 &amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#160;&amp;#">



<script type="text/javascript" id="hexo.configurations">
  var NexT = window.NexT || {};
  var CONFIG = {
    root: '/',
    scheme: 'Muse',
    sidebar: {"position":"left","display":"post","offset":12,"offset_float":0,"b2t":false,"scrollpercent":false},
    fancybox: true,
    motion: true,
    duoshuo: {
      userId: '0',
      author: '博主'
    },
    algolia: {
      applicationID: '',
      apiKey: '',
      indexName: '',
      hits: {"per_page":10},
      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
    }
  };
</script>



  <link rel="canonical" href="https://hcldirgit.github.io/2017/09/03/2. Linux 命令/59. Linux 命令- ss/"/>





  <title>Linux 命令- ss | 失落的乐章</title>
</head>

<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">

  




<script>
  (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
            (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
          m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
  })(window,document,'script','https://www.google-analytics.com/analytics.js','ga');
  ga('create', '85*****1', 'auto');
  ga('send', 'pageview');
</script>


  <script type="text/javascript">
    var _hmt = _hmt || [];
    (function() {
      var hm = document.createElement("script");
      hm.src = "https://hm.baidu.com/hm.js?87980c**************99ec5e26fb5";
      var s = document.getElementsByTagName("script")[0];
      s.parentNode.insertBefore(hm, s);
    })();
  </script>











  
  
    
  

  <div class="container sidebar-position-left page-post-detail ">
    <div class="headband"></div>

    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-wrapper">
  <div class="site-meta ">
    

    <div class="custom-logo-site-title">
      <a href="/"  class="brand" rel="start">
        <span class="logo-line-before"><i></i></span>
        <span class="site-title">失落的乐章</span>
        <span class="logo-line-after"><i></i></span>
      </a>
    </div>
      
        <p class="site-subtitle">技术面前，永远都是学生。</p>
      
  </div>

  <div class="site-nav-toggle">
    <button>
      <span class="btn-bar"></span>
      <span class="btn-bar"></span>
      <span class="btn-bar"></span>
    </button>
  </div>
</div>

<nav class="site-nav">
  

  
    <ul id="menu" class="menu">
      
        
        <li class="menu-item menu-item-home">
          <a href="/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-home"></i> <br />
            
            首页
          </a>
        </li>
      
        
        <li class="menu-item menu-item-categories">
          <a href="/categories" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-th"></i> <br />
            
            分类
          </a>
        </li>
      
        
        <li class="menu-item menu-item-tags">
          <a href="/tags" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-tags"></i> <br />
            
            标签
          </a>
        </li>
      
        
        <li class="menu-item menu-item-message">
          <a href="/message" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-external-link"></i> <br />
            
            留言
          </a>
        </li>
      

      
    </ul>
  

  
</nav>



 </div>
    </header>

    <main id="main" class="main">
      <div class="main-inner">
        <div class="content-wrap">
          <div id="content" class="content">
            

  <div id="posts" class="posts-expand">
    

  

  
  
  

  <article class="post post-type-normal " itemscope itemtype="http://schema.org/Article">
    <link itemprop="mainEntityOfPage" href="https://hcldirgit.github.io/2017/09/03/2. Linux 命令/59. Linux 命令- ss/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="name" content="失落的乐章">
      <meta itemprop="description" content="">
      <meta itemprop="image" content="/images/0.png">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="失落的乐章">
    </span>

    
      <header class="post-header">

        
        
          <h1 class="post-title" itemprop="name headline">Linux 命令- ss</h1>
        

        <div class="post-meta">
          <span class="post-time">
            
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              
                <span class="post-meta-item-text">发表于</span>
              
              <time title="创建于" itemprop="dateCreated datePublished" datetime="2017-09-03T01:57:34+08:00">
                2017-09-03
              </time>
            

            

            
          </span>

          

          
            
          

          
          

          

          

          

        </div>
      </header>
    

    <div class="post-body" itemprop="articleBody">

      
      

      
        <p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;ss是Socket Statistics的缩写。顾名思义，ss命令可以用来获取socket统计信息，它可以显示和netstat类似的内容。但ss的优势在于它能够显示更多更详细的有关TCP和连接状态的信息，而且比netstat更快速更高效。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;当服务器的socket连接数量变得非常大时，无论是使用netstat命令还是直接cat /proc/net/tcp，执行速度都会很慢。可能你不会有切身的感受，但请相信我，当服务器维持的连接达到上万个的时候，使用netstat等于浪费 生命，而用ss才是节省时间。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;天下武功唯快不破。ss快的秘诀在于，它利用到了TCP协议栈中tcp_diag。tcp_diag是一个用于分析统计的模块，可以获得Linux 内核中第一手的信息，这就确保了ss的快捷高效。当然，如果你的系统中没有tcp_diag，ss也可以正常运行，只是效率会变得稍慢。（但仍然比 netstat要快。）</p>
<h2 id="1-命令格式"><a href="#1-命令格式" class="headerlink" title="1.命令格式"></a>1.命令格式</h2><figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line">ss [参数]</div><div class="line">ss [参数] [过滤]</div></pre></td></tr></table></figure>
<h2 id="2-命令功能"><a href="#2-命令功能" class="headerlink" title="2.命令功能"></a>2.命令功能</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;ss(Socket Statistics的缩写)命令可以用来获取 socket统计信息，此命令输出的结果类似于 netstat输出的内容，但它能显示更多更详细的 TCP连接状态的信息，且比 netstat 更快速高效。它使用了 TCP协议栈中 tcp_diag（是一个用于分析统计的模块），能直接从获得第一手内核信息，这就使得 ss命令快捷高效。在没有 tcp_diag，ss也可以正常运行。</p>
<h2 id="3-命令参数"><a href="#3-命令参数" class="headerlink" title="3.命令参数"></a>3.命令参数</h2><ul>
<li>-h, –help    帮助信息</li>
<li>-V, –version    程序版本信息</li>
<li>-n, –numeric    不解析服务名称</li>
<li>-r, –resolve        解析主机名</li>
<li>-a, –all    显示所有套接字（sockets）</li>
<li>-l, –listening    显示监听状态的套接字（sockets）</li>
<li>-o, –options        显示计时器信息</li>
<li>-e, –extended       显示详细的套接字（sockets）信息</li>
<li>-m, –memory         显示套接字（socket）的内存使用情况</li>
<li>-p, –processes    显示使用套接字（socket）的进程</li>
<li>-i, –info    显示 TCP内部信息</li>
<li>-s, –summary    显示套接字（socket）使用概况</li>
<li>-4, –ipv4           仅显示IPv4的套接字（sockets）</li>
<li>-6, –ipv6           仅显示IPv6的套接字（sockets）</li>
<li>-0, –packet            显示 PACKET 套接字（socket）</li>
<li>-t, –tcp    仅显示 TCP套接字（sockets）</li>
<li>-u, –udp    仅显示 UCP套接字（sockets）</li>
<li>-d, –dccp    仅显示 DCCP套接字（sockets）</li>
<li>-w, –raw    仅显示 RAW套接字（sockets）</li>
<li>-x, –unix    仅显示 Unix套接字（sockets）</li>
<li>-f, –family=FAMILY  显示 FAMILY类型的套接字（sockets），FAMILY可选，支持  unix, inet, inet6, link, netlink</li>
<li>-A, –query=QUERY, –socket=QUERY<ul>
<li>QUERY := {all|inet|tcp|udp|raw|unix|packet|netlink}[,QUERY]</li>
</ul>
</li>
<li>-D, –diag=FILE     将原始TCP套接字（sockets）信息转储到文件</li>
<li>-F, –filter=FILE   从文件中都去过滤器信息<ul>
<li>FILTER := [ state TCP-STATE ] [ EXPRESSION ]</li>
</ul>
</li>
</ul>
<h2 id="4-使用实例"><a href="#4-使用实例" class="headerlink" title="4.使用实例"></a>4.使用实例</h2><h3 id="实例1：显示TCP连接"><a href="#实例1：显示TCP连接" class="headerlink" title="实例1：显示TCP连接"></a>实例1：显示TCP连接</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>命令</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">ss -t -a</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>输出</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># ss -t -a</span></div><div class="line">State      Recv-Q Send-Q                                Local Address:Port                                    Peer Address:Port   </div><div class="line">LISTEN     0      0                                         127.0.0.1:smux                                               *:*       </div><div class="line">LISTEN     0      0                                                 *:3690                                               *:*       </div><div class="line">LISTEN     0      0                                                 *:ssh                                                *:*       </div><div class="line">ESTAB      0      0                                   192.168.120.204:ssh                                        10.2.0.68:49368   </div><div class="line">[root@localhost ~]<span class="comment">#</span></div></pre></td></tr></table></figure>
<h3 id="实例2：显示-Sockets-摘要"><a href="#实例2：显示-Sockets-摘要" class="headerlink" title="实例2：显示 Sockets 摘要"></a>实例2：显示 Sockets 摘要</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>命令</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">ss -s</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>输出</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># ss -s</span></div><div class="line">Total: 34 (kernel 48)</div><div class="line">TCP:   4 (estab 1, closed 0, orphaned 0, synrecv 0, timewait 0/0), ports 3</div><div class="line"></div><div class="line">Transport Total     IP        IPv6</div><div class="line">*         48        -         -        </div><div class="line">RAW       0         0         0        </div><div class="line">UDP       5         5         0        </div><div class="line">TCP       4         4         0        </div><div class="line">INET      9         9         0        </div><div class="line">FRAG      0         0         0        </div><div class="line"></div><div class="line">[root@localhost ~]<span class="comment">#</span></div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>说明</strong></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;列出当前的established, closed, orphaned and waiting TCP sockets</p>
<h3 id="实例3：列出所有打开的网络连接端口"><a href="#实例3：列出所有打开的网络连接端口" class="headerlink" title="实例3：列出所有打开的网络连接端口"></a>实例3：列出所有打开的网络连接端口</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>命令</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">ss -l</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>输出</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># ss -l</span></div><div class="line">Recv-Q Send-Q                                     Local Address:Port                                         Peer Address:Port   </div><div class="line">0      0                                              127.0.0.1:smux                                                    *:*       </div><div class="line">0      0                                                      *:3690                                                    *:*       </div><div class="line">0      0                                                      *:ssh                                                     *:*       </div><div class="line">[root@localhost ~]<span class="comment">#</span></div></pre></td></tr></table></figure>
<h3 id="实例4：查看进程使用的socket"><a href="#实例4：查看进程使用的socket" class="headerlink" title="实例4：查看进程使用的socket"></a>实例4：查看进程使用的socket</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>命令</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">ss -pl</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>输出</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># ss -pl</span></div><div class="line">Recv-Q Send-Q                                     Local Address:Port                                         Peer Address:Port   </div><div class="line">0      0                                              127.0.0.1:smux                                                    *:*        users:((<span class="string">"snmpd"</span>,2716,8))</div><div class="line">0      0                                                      *:3690                                                    *:*        users:((<span class="string">"svnserve"</span>,3590,3))</div><div class="line">0      0                                                      *:ssh                                                     *:*        users:((<span class="string">"sshd"</span>,2735,3))</div><div class="line">[root@localhost ~]<span class="comment">#</span></div></pre></td></tr></table></figure>
<h3 id="实例5：找出打开套接字-端口应用程序"><a href="#实例5：找出打开套接字-端口应用程序" class="headerlink" title="实例5：找出打开套接字/端口应用程序"></a>实例5：找出打开套接字/端口应用程序</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>命令</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">ss -lp | grep 3306</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>输出</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># ss -lp|grep 1935</span></div><div class="line">0      0                            *:1935                          *:*        users:((<span class="string">"fmsedge"</span>,2913,18))</div><div class="line">0      0                    127.0.0.1:19350                         *:*        users:((<span class="string">"fmsedge"</span>,2913,17))</div><div class="line">[root@localhost ~]<span class="comment"># ss -lp|grep 3306</span></div><div class="line">0      0                            *:3306                          *:*        users:((<span class="string">"mysqld"</span>,2871,10))</div><div class="line">[root@localhost ~]<span class="comment">#</span></div></pre></td></tr></table></figure>
<h3 id="实例6：显示所有UDP-Sockets"><a href="#实例6：显示所有UDP-Sockets" class="headerlink" title="实例6：显示所有UDP Sockets"></a>实例6：显示所有UDP Sockets</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>命令</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">ss -u -a</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>输出</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># ss -u -a</span></div><div class="line">State      Recv-Q Send-Q                                Local Address:Port                                    Peer Address:Port   </div><div class="line">UNCONN     0      0                                         127.0.0.1:syslog                                             *:*       </div><div class="line">UNCONN     0      0                                                 *:snmp                                               *:*       </div><div class="line">ESTAB      0      0                                   192.168.120.203:39641                                  10.58.119.119:domain </div><div class="line">[root@localhost ~]<span class="comment">#</span></div></pre></td></tr></table></figure>
<h3 id="实例7：显示所有状态为established的SMTP连接"><a href="#实例7：显示所有状态为established的SMTP连接" class="headerlink" title="实例7：显示所有状态为established的SMTP连接"></a>实例7：显示所有状态为established的SMTP连接</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>命令</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">ss -o state established <span class="string">'( dport = :smtp or sport = :smtp )'</span></div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>输出</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># ss -o state established '( dport = :smtp or sport = :smtp )' </span></div><div class="line">Recv-Q Send-Q                                     Local Address:Port                                         Peer Address:Port   </div><div class="line">[root@localhost ~]<span class="comment">#</span></div></pre></td></tr></table></figure>
<h3 id="实例8：显示所有状态为Established的HTTP连接"><a href="#实例8：显示所有状态为Established的HTTP连接" class="headerlink" title="实例8：显示所有状态为Established的HTTP连接"></a>实例8：显示所有状态为Established的HTTP连接</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>命令</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">ss -o state established <span class="string">'( dport = :http or sport = :http )'</span></div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>输出</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># ss -o state established '( dport = :http or sport = :http )' </span></div><div class="line">Recv-Q Send-Q                                     Local Address:Port                                         Peer Address:Port   </div><div class="line">0      0                                              75.126.153.214:2164                                        192.168.10.42:http    </div><div class="line">[root@localhost ~]<span class="comment">#</span></div></pre></td></tr></table></figure>
<h3 id="实例9：列举出处于-FIN-WAIT-1状态的源端口为-80或者-443，目标网络为-193-233-7-24所有-tcp套接字"><a href="#实例9：列举出处于-FIN-WAIT-1状态的源端口为-80或者-443，目标网络为-193-233-7-24所有-tcp套接字" class="headerlink" title="实例9：列举出处于 FIN-WAIT-1状态的源端口为 80或者 443，目标网络为 193.233.7/24所有 tcp套接字"></a>实例9：列举出处于 FIN-WAIT-1状态的源端口为 80或者 443，目标网络为 193.233.7/24所有 tcp套接字</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>命令</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">ss -o state fin-wait-1 <span class="string">'( sport = :http or sport = :https )'</span> dst 193.233.7/24</div></pre></td></tr></table></figure>
<h3 id="实例10：用TCP-状态过滤Sockets"><a href="#实例10：用TCP-状态过滤Sockets" class="headerlink" title="实例10：用TCP 状态过滤Sockets:"></a>实例10：用TCP 状态过滤Sockets:</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>命令</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line">ss -4 state FILTER-NAME-HERE </div><div class="line">ss -6 state FILTER-NAME-HERE</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>输出</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment">#ss -4 state closing </span></div><div class="line">Recv-Q Send-Q                                                  Local Address:Port                                                      Peer Address:Port </div><div class="line">1      11094                                                  75.126.153.214:http                                                      192.168.10.42:4669</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>说明</strong></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;FILTER-NAME-HERE 可以代表以下任何一个：</p>
<ul>
<li>established      </li>
<li>syn-sent      </li>
<li>syn-recv      </li>
<li>fin-wait-1      </li>
<li>fin-wait-2      </li>
<li>time-wait      </li>
<li>closed      </li>
<li>close-wait      </li>
<li>last-ack      </li>
<li>listen      </li>
<li>closing      </li>
</ul>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;all : 所有以上状态</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;connected : 除了listen and closed的所有状态</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;synchronized :所有已连接的状态除了syn-sent</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;bucket : 显示状态为maintained as minisockets,如：time-wait和syn-recv.</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;big : 和bucket相反.</p>
<h3 id="实例11：匹配远程地址和端口号"><a href="#实例11：匹配远程地址和端口号" class="headerlink" title="实例11：匹配远程地址和端口号"></a>实例11：匹配远程地址和端口号</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>命令</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div></pre></td><td class="code"><pre><div class="line">ss dst ADDRESS_PATTERN</div><div class="line">ss dst 192.168.1.5</div><div class="line">ss dst 192.168.119.113:http </div><div class="line">ss dst 192.168.119.113:smtp </div><div class="line">ss dst 192.168.119.113:443</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>输出</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># ss dst 192.168.119.113</span></div><div class="line">State      Recv-Q Send-Q                                Local Address:Port                                    Peer Address:Port   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16014                                192.168.119.113:20229   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16014                                192.168.119.113:61056   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16014                                192.168.119.113:61623   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16014                                192.168.119.113:60924   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16050                                192.168.119.113:43701   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16073                                192.168.119.113:32930   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16073                                192.168.119.113:49318   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16014                                192.168.119.113:3844    </div><div class="line">[root@localhost ~]<span class="comment"># ss dst 192.168.119.113:http</span></div><div class="line">State      Recv-Q Send-Q                                Local Address:Port                                    Peer Address:Port   </div><div class="line">[root@localhost ~]<span class="comment"># ss dst 192.168.119.113:3844</span></div><div class="line">State      Recv-Q Send-Q                                Local Address:Port                                    Peer Address:Port   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16014                                192.168.119.113:3844    </div><div class="line">[root@localhost ~]<span class="comment">#</span></div></pre></td></tr></table></figure>
<h3 id="实例12：匹配本地地址和端口号"><a href="#实例12：匹配本地地址和端口号" class="headerlink" title="实例12：匹配本地地址和端口号"></a>实例12：匹配本地地址和端口号</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>命令</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div></pre></td><td class="code"><pre><div class="line">ss src ADDRESS_PATTERN</div><div class="line">ss src 192.168.119.103</div><div class="line">ss src 192.168.119.103:http</div><div class="line">ss src 192.168.119.103:80</div><div class="line">ss src 192.168.119.103:smtp</div><div class="line">ss src 192.168.119.103:25</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>输出</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># ss src 192.168.119.103:16021</span></div><div class="line">State      Recv-Q Send-Q                                Local Address:Port                                    Peer Address:Port   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16021                                192.168.119.201:63054   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16021                                192.168.119.201:62894   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16021                                192.168.119.201:63055   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16021                                192.168.119.201:2274    </div><div class="line">ESTAB      0      0                                   192.168.119.103:16021                                192.168.119.201:44784   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16021                                192.168.119.201:7233    </div><div class="line">ESTAB      0      0                                   192.168.119.103:16021                                192.168.119.103:58660   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16021                                192.168.119.201:44822   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16021                                     10.2.1.206:56737   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16021                                     10.2.1.206:57487   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16021                                     10.2.1.206:56736   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16021                                     10.2.1.206:64652   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16021                                     10.2.1.206:56586   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16021                                     10.2.1.206:64653   </div><div class="line">ESTAB      0      0                                   192.168.119.103:16021                                     10.2.1.206:56587   </div><div class="line">[root@localhost ~]<span class="comment">#</span></div></pre></td></tr></table></figure>
<h3 id="实例13：将本地或者远程端口和一个数比较"><a href="#实例13：将本地或者远程端口和一个数比较" class="headerlink" title="实例13：将本地或者远程端口和一个数比较"></a>实例13：将本地或者远程端口和一个数比较</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>命令</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line">ss dport OP PORT </div><div class="line">ss sport OP PORT</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>输出</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># ss  sport = :http </span></div><div class="line">[root@localhost ~]<span class="comment"># ss  dport = :http </span></div><div class="line">[root@localhost ~]<span class="comment"># ss  dport \&gt; :1024 </span></div><div class="line">[root@localhost ~]<span class="comment"># ss  sport \&gt; :1024 </span></div><div class="line">[root@localhost ~]<span class="comment"># ss sport \&lt; :32000 </span></div><div class="line">[root@localhost ~]<span class="comment"># ss  sport eq :22 </span></div><div class="line">[root@localhost ~]<span class="comment"># ss  dport != :22 </span></div><div class="line">[root@localhost ~]<span class="comment"># ss  state connected sport = :http </span></div><div class="line">[root@localhost ~]<span class="comment"># ss \( sport = :http or sport = :https \) </span></div><div class="line">[root@localhost ~]<span class="comment"># ss -o state fin-wait-1 \( sport = :http or sport = :https \) dst 192.168.1/24</span></div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>说明</strong></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;ss dport OP PORT 远程端口和一个数比较；ss sport OP PORT 本地端口和一个数比较。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>OP 可以代表以下任意一个:</strong> </p>
<ul>
<li>&lt;= or le : 小于或等于端口号</li>
<li><blockquote>
<p>= or ge : 大于或等于端口号</p>
</blockquote>
</li>
<li>== or eq : 等于端口号</li>
<li>!= or ne : 不等于端口号</li>
<li>&lt; or lt : 小于端口号</li>
<li><blockquote>
<p>or gt : 大于端口号</p>
</blockquote>
</li>
</ul>
<h3 id="实例14：ss-和-netstat-效率对比"><a href="#实例14：ss-和-netstat-效率对比" class="headerlink" title="实例14：ss 和 netstat 效率对比"></a>实例14：ss 和 netstat 效率对比</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>命令</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line">time netstat -at</div><div class="line">time ss</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>输出</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># time ss   </span></div><div class="line">real    0m0.739s</div><div class="line">user    0m0.019s</div><div class="line">sys     0m0.013s</div><div class="line">[root@localhost ~]<span class="comment"># </span></div><div class="line">[root@localhost ~]<span class="comment"># time netstat -at</span></div><div class="line">real    2m45.907s</div><div class="line">user    0m0.063s</div><div class="line">sys     0m0.067s</div><div class="line">[root@localhost ~]<span class="comment">#</span></div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>说明</strong></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;用time 命令分别获取通过netstat和ss命令获取程序和概要占用资源所使用的时间。在服务器连接数比较多的时候，netstat的效率完全没法和ss比。</p>

      
    </div>

    <div>
      
        

      
    </div>

    <div>
      
        

      
    </div>

    <div>
      
        

      
    </div>

    <footer class="post-footer">
      
        <div class="post-tags">
          
            <a href="/tags/Linux命令/" rel="tag"># Linux命令</a>
          
        </div>
      

      
      
      

      
        <div class="post-nav">
          <div class="post-nav-next post-nav-item">
            
              <a href="/2017/09/03/2. Linux 命令/75. Linux 磁盘管理/" rel="next" title="Linux 磁盘管理">
                <i class="fa fa-chevron-left"></i> Linux 磁盘管理
              </a>
            
          </div>

          <span class="post-nav-divider"></span>

          <div class="post-nav-prev post-nav-item">
            
              <a href="/2017/09/03/2. Linux 命令/15. Linux 命令- tail/" rel="prev" title="Linux 命令- tail">
                Linux 命令- tail <i class="fa fa-chevron-right"></i>
              </a>
            
          </div>
        </div>
      

      
      
    </footer>
  </article>



    <div class="post-spread">
      
    </div>
  </div>


          </div>
          


          
  <div class="comments" id="comments">
    
  </div>


        </div>
        
          
  
  <div class="sidebar-toggle">
    <div class="sidebar-toggle-line-wrap">
      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
    </div>
  </div>

  <aside id="sidebar" class="sidebar">
    <div class="sidebar-inner">

      

      
        <ul class="sidebar-nav motion-element">
          <li class="sidebar-nav-toc sidebar-nav-active" data-target="post-toc-wrap" >
            文章目录
          </li>
          <li class="sidebar-nav-overview" data-target="site-overview">
            站点概览
          </li>
        </ul>
      

      <section class="site-overview sidebar-panel">
        <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
          <img class="site-author-image" itemprop="image"
               src="/images/0.png"
               alt="失落的乐章" />
          <p class="site-author-name" itemprop="name">失落的乐章</p>
           
              <p class="site-description motion-element" itemprop="description">失落的乐章的Blog</p>
          
        </div>
        <nav class="site-state motion-element">

          
            <div class="site-state-item site-state-posts">
              <a href="/">
                <span class="site-state-item-count">627</span>
                <span class="site-state-item-name">日志</span>
              </a>
            </div>
          

          

          
            
            
            <div class="site-state-item site-state-tags">
              <a href="/tags/index.html">
                <span class="site-state-item-count">38</span>
                <span class="site-state-item-name">标签</span>
              </a>
            </div>
          

        </nav>

        

        <div class="links-of-author motion-element">
          
            
              <span class="links-of-author-item">
                <a href="https://github.com/hcldirgit" target="_blank" title="GitHub">
                  
                    <i class="fa fa-fw fa-github"></i>
                  
                  GitHub
                </a>
              </span>
            
          
        </div>

        
        

        
        

        


      </section>

      
      <!--noindex-->
        <section class="post-toc-wrap motion-element sidebar-panel sidebar-panel-active">
          <div class="post-toc">

            
              
            

            
              <div class="post-toc-content"><ol class="nav"><li class="nav-item nav-level-2"><a class="nav-link" href="#1-命令格式"><span class="nav-number">1.</span> <span class="nav-text">1.命令格式</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#2-命令功能"><span class="nav-number">2.</span> <span class="nav-text">2.命令功能</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#3-命令参数"><span class="nav-number">3.</span> <span class="nav-text">3.命令参数</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#4-使用实例"><span class="nav-number">4.</span> <span class="nav-text">4.使用实例</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#实例1：显示TCP连接"><span class="nav-number">4.1.</span> <span class="nav-text">实例1：显示TCP连接</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#实例2：显示-Sockets-摘要"><span class="nav-number">4.2.</span> <span class="nav-text">实例2：显示 Sockets 摘要</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#实例3：列出所有打开的网络连接端口"><span class="nav-number">4.3.</span> <span class="nav-text">实例3：列出所有打开的网络连接端口</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#实例4：查看进程使用的socket"><span class="nav-number">4.4.</span> <span class="nav-text">实例4：查看进程使用的socket</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#实例5：找出打开套接字-端口应用程序"><span class="nav-number">4.5.</span> <span class="nav-text">实例5：找出打开套接字/端口应用程序</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#实例6：显示所有UDP-Sockets"><span class="nav-number">4.6.</span> <span class="nav-text">实例6：显示所有UDP Sockets</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#实例7：显示所有状态为established的SMTP连接"><span class="nav-number">4.7.</span> <span class="nav-text">实例7：显示所有状态为established的SMTP连接</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#实例8：显示所有状态为Established的HTTP连接"><span class="nav-number">4.8.</span> <span class="nav-text">实例8：显示所有状态为Established的HTTP连接</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#实例9：列举出处于-FIN-WAIT-1状态的源端口为-80或者-443，目标网络为-193-233-7-24所有-tcp套接字"><span class="nav-number">4.9.</span> <span class="nav-text">实例9：列举出处于 FIN-WAIT-1状态的源端口为 80或者 443，目标网络为 193.233.7/24所有 tcp套接字</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#实例10：用TCP-状态过滤Sockets"><span class="nav-number">4.10.</span> <span class="nav-text">实例10：用TCP 状态过滤Sockets:</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#实例11：匹配远程地址和端口号"><span class="nav-number">4.11.</span> <span class="nav-text">实例11：匹配远程地址和端口号</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#实例12：匹配本地地址和端口号"><span class="nav-number">4.12.</span> <span class="nav-text">实例12：匹配本地地址和端口号</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#实例13：将本地或者远程端口和一个数比较"><span class="nav-number">4.13.</span> <span class="nav-text">实例13：将本地或者远程端口和一个数比较</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#实例14：ss-和-netstat-效率对比"><span class="nav-number">4.14.</span> <span class="nav-text">实例14：ss 和 netstat 效率对比</span></a></li></ol></li></ol></div>
            

          </div>
        </section>
      <!--/noindex-->
      

      

    </div>
  </aside>


        
      </div>
    </main>

    <footer id="footer" class="footer">
      <div class="footer-inner">
        <div class="copyright" >
  
  &copy; 
  <span itemprop="copyrightYear">2017</span>
  <span class="with-love">
    <i class="fa fa-heart"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">失落的乐章</span>
</div>


<div class="powered-by">
  由 <a class="theme-link" href="https://hexo.io">Hexo</a> 强力驱动
</div>

<div class="theme-info">
  主题 -
  <a class="theme-link" href="https://github.com/iissnan/hexo-theme-next">
    NexT.Muse
  </a>
</div>


        

        
      </div>
    </footer>

    
      <div class="back-to-top">
        <i class="fa fa-arrow-up"></i>
        
      </div>
    

  </div>

  

<script type="text/javascript">
  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
    window.Promise = null;
  }
</script>









  












  
  <script type="text/javascript" src="/lib/jquery/index.js?v=2.1.3"></script>

  
  <script type="text/javascript" src="/lib/fastclick/lib/fastclick.min.js?v=1.0.6"></script>

  
  <script type="text/javascript" src="/lib/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>

  
  <script type="text/javascript" src="/lib/velocity/velocity.min.js?v=1.2.1"></script>

  
  <script type="text/javascript" src="/lib/velocity/velocity.ui.min.js?v=1.2.1"></script>

  
  <script type="text/javascript" src="/lib/fancybox/source/jquery.fancybox.pack.js?v=2.1.5"></script>


  


  <script type="text/javascript" src="/js/src/utils.js?v=5.1.1"></script>

  <script type="text/javascript" src="/js/src/motion.js?v=5.1.1"></script>



  
  

  
  <script type="text/javascript" src="/js/src/scrollspy.js?v=5.1.1"></script>
<script type="text/javascript" src="/js/src/post-details.js?v=5.1.1"></script>



  


  <script type="text/javascript" src="/js/src/bootstrap.js?v=5.1.1"></script>



  


  




	





  





  





  






  





  

  

  

  

  

  

</body>
</html>
